diff --git a/Cargo.lock b/Cargo.lock
index 2d3d6f548..112974125 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -4490,7 +4490,7 @@ version = "0.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3ffa00dec017b5b1a8b7cf5e2c008bfda1aa7e0697ac1508b491fdf2622fb4d8"
 dependencies = [
- "rand 0.8.7",
+ "rand 0.8.8",
 ]
 
 [[package]]
@@ -5948,7 +5948,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5d5285893bb5eb82e6aaf5d59ee909a06a16737a8970984dd7746ba9283498d6"
 dependencies = [
  "phf_shared 0.10.0",
- "rand 0.8.7",
+ "rand 0.8.8",
 ]
 
 [[package]]
@@ -5958,7 +5958,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3c80231409c20246a13fddb31776fb942c38553c51e871f8cbd687a4cfb5843d"
 dependencies = [
  "phf_shared 0.11.3",
- "rand 0.8.7",
+ "rand 0.8.8",
 ]
 
 [[package]]
@@ -6522,9 +6522,9 @@ dependencies = [
 
 [[package]]
 name = "rand"
-version = "0.8.7"
+version = "0.8.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "22f6172bdec972074665ed81ed53b71da00bfc44b65a753cfde883ec4c702a1a"
+checksum = "e058c7de0b26af77780c769414d6257830bb240f3c38477dbc2c16e5f54d6d4c"
 dependencies = [
  "libc",
  "rand_chacha 0.3.1",
@@ -11325,7 +11325,7 @@ dependencies = [
  "pretty_graphql",
  "r2d2",
  "r2d2_sqlite",
- "rand 0.9.5",
+ "rand 0.10.2",
  "reqwest",
  "rlimit",
  "serde",
@@ -11415,7 +11415,7 @@ dependencies = [
  "log 0.4.34",
  "oxc_resolver",
  "predicates",
- "rand 0.8.7",
+ "rand 0.10.2",
  "reqwest",
  "rmcp",
  "rolldown",
@@ -11646,7 +11646,7 @@ dependencies = [
  "csscolorparser",
  "log 0.4.34",
  "objc",
- "rand 0.9.5",
+ "rand 0.10.2",
  "tauri",
  "tauri-plugin",
 ]
@@ -11726,7 +11726,7 @@ dependencies = [
  "log 0.4.34",
  "md5 0.7.0",
  "path-slash",
- "rand 0.9.5",
+ "rand 0.10.2",
  "reqwest",
  "serde",
  "serde_json",
@@ -11978,7 +11978,7 @@ version = "0.1.0"
 dependencies = [
  "log 0.4.34",
  "md5 0.8.0",
- "rand 0.9.5",
+ "rand 0.10.2",
  "serde",
  "serde_json",
  "tauri",
diff --git a/crates-cli/yaak-cli/Cargo.toml b/crates-cli/yaak-cli/Cargo.toml
index 5378975dc..4a7e59719 100644
--- a/crates-cli/yaak-cli/Cargo.toml
+++ b/crates-cli/yaak-cli/Cargo.toml
@@ -21,7 +21,7 @@ hex = { workspace = true }
 include_dir = "0.7"
 keyring = { workspace = true, features = ["apple-native", "windows-native", "sync-secret-service"] }
 log = { workspace = true }
-rand = "0.8"
+rand = "0.10"
 reqwest = { workspace = true, features = ["form"] }
 rolldown = "0.1.0"
 # Pinned exactly: rolldown_resolver takes `oxc_resolver = "^11"`, so cargo
diff --git a/crates-cli/yaak-cli/src/commands/auth.rs b/crates-cli/yaak-cli/src/commands/auth.rs
index b0ece3fb9..3d7673184 100644
--- a/crates-cli/yaak-cli/src/commands/auth.rs
+++ b/crates-cli/yaak-cli/src/commands/auth.rs
@@ -3,8 +3,8 @@ use crate::ui;
 use crate::utils::http;
 use base64::Engine as _;
 use keyring::Entry;
-use rand::RngCore;
-use rand::rngs::OsRng;
+use rand::TryRng;
+use rand::rngs::SysRng;
 use reqwest::Url;
 use serde_json::Value;
 use sha2::{Digest, Sha256};
@@ -443,7 +443,7 @@ fn delete_auth_token(environment: Environment) -> CommandResult {
 
 fn random_hex(bytes: usize) -> String {
     let mut data = vec![0_u8; bytes];
-    OsRng.fill_bytes(&mut data);
+    SysRng.try_fill_bytes(&mut data).expect("OS random source failed");
     hex::encode(data)
 }
 
diff --git a/crates-cli/yaak-cli/src/commands/mcp.rs b/crates-cli/yaak-cli/src/commands/mcp.rs
index aef666b6e..e5356bd43 100644
--- a/crates-cli/yaak-cli/src/commands/mcp.rs
+++ b/crates-cli/yaak-cli/src/commands/mcp.rs
@@ -1,7 +1,7 @@
 use crate::cli::McpArgs;
 use crate::context::{CliContext, CliExecutionContext};
 use crate::plugin_events::SendContexts;
-use rand::Rng;
+use rand::RngExt;
 use std::net::{Ipv4Addr, SocketAddr};
 use std::path::PathBuf;
 use std::sync::Arc;
@@ -76,7 +76,7 @@ async fn serve_http(host: CliMcpHost, port: u16, token: Option<String>) -> Resul
 }
 
 fn generate_token() -> String {
-    hex::encode(rand::thread_rng().r#gen::<[u8; 32]>())
+    hex::encode(rand::rng().random::<[u8; 32]>())
 }
 
 /// Every workspace in the database is "open", and the global `--environment`
diff --git a/crates-cli/yaak-cli/src/commands/plugin.rs b/crates-cli/yaak-cli/src/commands/plugin.rs
index 23e384544..6da2ca3bb 100644
--- a/crates-cli/yaak-cli/src/commands/plugin.rs
+++ b/crates-cli/yaak-cli/src/commands/plugin.rs
@@ -3,7 +3,7 @@ use crate::context::CliContext;
 use crate::ui;
 use crate::utils::http;
 use keyring::Entry;
-use rand::Rng;
+use rand::RngExt;
 use rolldown::{
     BundleEvent, Bundler, BundlerOptions, ExperimentalOptions, InputItem, LogLevel, OutputFormat,
     Platform, WatchOption, Watcher, WatcherEvent,
@@ -724,9 +724,9 @@ fn random_name() -> String {
         "yak", "yarn", "year", "yell", "yoke", "yoga", "yam", "yacht", "yodel",
     ];
 
-    let mut rng = rand::thread_rng();
-    let adjective = ADJECTIVES[rng.gen_range(0..ADJECTIVES.len())];
-    let noun = NOUNS[rng.gen_range(0..NOUNS.len())];
+    let mut rng = rand::rng();
+    let adjective = ADJECTIVES[rng.random_range(0..ADJECTIVES.len())];
+    let noun = NOUNS[rng.random_range(0..NOUNS.len())];
     format!("{adjective}-{noun}")
 }
 
diff --git a/crates-tauri/yaak-app-client/Cargo.toml b/crates-tauri/yaak-app-client/Cargo.toml
index ed7547c6b..5465d98cd 100644
--- a/crates-tauri/yaak-app-client/Cargo.toml
+++ b/crates-tauri/yaak-app-client/Cargo.toml
@@ -41,7 +41,7 @@ pretty_graphql = "0.2"
 r2d2 = "0.8.10"
 r2d2_sqlite = "0.32"
 mime_guess = "2.0.5"
-rand = "0.9.0"
+rand = "0.10.2"
 reqwest = { workspace = true, features = [
   "multipart",
   "gzip",
diff --git a/crates-tauri/yaak-mac-window/Cargo.toml b/crates-tauri/yaak-mac-window/Cargo.toml
index ef2214e9d..31e0b0baa 100644
--- a/crates-tauri/yaak-mac-window/Cargo.toml
+++ b/crates-tauri/yaak-mac-window/Cargo.toml
@@ -15,7 +15,7 @@ tauri-plugin = { workspace = true, features = ["build"] }
 cocoa = "0.27.0"
 log = { workspace = true }
 objc = "0.2.7"
-rand = "0.9.0"
+rand = "0.10.2"
 csscolorparser = "0.9.0"
 
 [dependencies]
diff --git a/crates-tauri/yaak-mac-window/src/mac.rs b/crates-tauri/yaak-mac-window/src/mac.rs
index e45d0bd45..c4aee811e 100644
--- a/crates-tauri/yaak-mac-window/src/mac.rs
+++ b/crates-tauri/yaak-mac-window/src/mac.rs
@@ -147,7 +147,7 @@ pub fn setup_traffic_light_positioner<R: Runtime>(window: &Window<R>) {
     use cocoa::delegate;
     use cocoa::foundation::NSUInteger;
     use objc::runtime::{Object, Sel};
-    use rand::Rng;
+    use rand::RngExt;
     use rand::distr::Alphanumeric;
     use std::ffi::c_void;
 
diff --git a/crates-tauri/yaak-window/Cargo.toml b/crates-tauri/yaak-window/Cargo.toml
index 36cd25cd1..713f8db53 100644
--- a/crates-tauri/yaak-window/Cargo.toml
+++ b/crates-tauri/yaak-window/Cargo.toml
@@ -7,7 +7,7 @@ publish = false
 [dependencies]
 log = { workspace = true }
 md5 = "0.8.0"
-rand = "0.9.0"
+rand = "0.10.2"
 serde = { workspace = true, features = ["derive"] }
 serde_json = { workspace = true }
 tauri = { workspace = true }
diff --git a/crates/yaak-plugins/Cargo.toml b/crates/yaak-plugins/Cargo.toml
index 2c3d962d9..742223e18 100644
--- a/crates/yaak-plugins/Cargo.toml
+++ b/crates/yaak-plugins/Cargo.toml
@@ -14,7 +14,7 @@ keyring = { workspace = true, features = ["apple-native", "windows-native", "syn
 log = { workspace = true }
 md5 = "0.7.0"
 path-slash = "0.2.1"
-rand = "0.9.0"
+rand = "0.10.2"
 reqwest = { workspace = true, features = ["json"] }
 serde = { workspace = true, features = ["derive"] }
 serde_json = { workspace = true }
diff --git a/crates/yaak-plugins/src/util.rs b/crates/yaak-plugins/src/util.rs
index 055f73ff5..2c0457c17 100644
--- a/crates/yaak-plugins/src/util.rs
+++ b/crates/yaak-plugins/src/util.rs
@@ -1,4 +1,4 @@
-use rand::Rng;
+use rand::RngExt;
 use rand::distr::Alphanumeric;
 
 pub fn gen_id() -> String {